Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I responded to an email from a hacker posing as a friend in distress. I have a really long secure password ... caps/special figures/numbers/over 14 characters long. My account name is my first, middle initial, and last name. I just changed my security question to something I believe is not guessable. I have other accounts associated with my account that are not as secure (password not as long/no special figures or caps) and am going about changing their security questions and passwords. Anything else I should do? Do you think I'll be ok?

share|improve this question
3  
What information did you provide to the phisher? –  Andy Smith Oct 12 '12 at 17:05
    
I typed "let me know what is going on (the email said she had lost her wallet travelling in Spain) ... and tell me who it is we helped together in 2004 so I know this is you" I was smart "in" my reply, but not smart about that if it was a hoax they would then have my email address and name. Kicking myself for that one little click ...! –  Jen Oct 12 '12 at 17:36
    
Your email address and name are more than likely public information anyway. –  Stephen Touset Oct 12 '12 at 22:40
1  
Sounds like you're fine - the only thing I can see happening from this is your email address being starred as someone to phish again :). Keep your passwords different and complicated, you'll be fine. –  Andy Smith Oct 13 '12 at 8:53

3 Answers 3

Based upon the information you have provided -- I would not bother doing anything.

This is most likely a social engineering attack, where they're going to try to persuade you to wire money via Western Union to some location where they (or a confederate) is ready to pick up the money. It sounds like you did not provide them with any useful information. Your email address and name is already information they could easily obtain, and isn't likely to be very helpful in attacking you via any method I can imagine.

You mentioned you already have chosen a long and strong password for your email account. That's good, and the main thing. I don't think you really need to do anything else at this stage.

If you have other accounts that you care about with a poor password, it wouldn't be a bad idea to change those passwords to something stronger -- not so much because of this incident, but rather because this is as good a time as any to do some basic security hygiene. Also, if you don't already use your browser's password manager, I encourage you to start using it. Password managers make it easier to use long and strong passwords, and reduce the temptation to pick something guessable.

share|improve this answer

Probably - phishing is a volume business so any added level of difficulty is reason to move on to an easier target - your plan seems reasonably sound - keep an eye on things, make sure all the passwords are different, and closely watch anything that has anything to do with money :-)

share|improve this answer
    
Thanks for your assurance! –  Jen Oct 12 '12 at 17:36

This sounds more like a social attack. Having your email address and name doesn't get somebody much other than launching a targeted attack against your password. I would expect they were just looking for someone to wire money with no verification. There really isn't any increased risk to you at this point.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.